HackingFinancial ServicesTechnologyFinanceVulnerability ExploitZero-DayData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountLowContained

Webster Bank, National Association

bd_02183b193ff7c423 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 31, 2023

Filed

Nov 27, 2023

To disclose

26 weeks

Affected

9state residents only

Confidence

66%

Full breach record for Webster Bank, National Association →7 incidents on file

FIS reported a data security incident involving its third-party vendor Progress Software's MOVEit Transfer tool. A zero-day vulnerability allowed an unauthorized third party to access files transferred from Webster Bank's client, the New Bedford Retirement Board. The incident affected 9 New Hampshire residents, exposing names and financial account/routing numbers. FIS disabled the tool, patched systems, and engaged law enforcement and forensic experts.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 26 weeks / 180 days

May 31, 2023

Begins

May 31, 2023

Discovered

Nov 27, 2023

Filed

vs. sector median

+18 wks slower

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed9 affectedView incident

Name: FIDELITY NATIONAL INFORMATION SERVICES, INC.
norm: fidelity national information
Domain: fisglobal.com

Name: Webster Bank, National Association
norm: webster bank national
Industry: Financial ServicesllmTechnologyllm

Discovered: May 31, 2023
Breach occurred: May 31, 2023 – Jun 1, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 16, 2023
Affected individuals: 9state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Immediately ceased using MOVEit Transfer and disabled it in its system
Successfully deployed patches on all instances of the MOVEit Transfer applications
Launched an investigation with the assistance of cyber experts
Notified law enforcement
Changes made: Taking steps to further secure its use of all third-party transfer tools
Offering complimentary credit monitoring to affected individuals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(180 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/fidelity-national-information-services-20231127.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 27, 2023
Raw hash: 0232815e7c5babd1bd133ab2c52831fe6ec1e825e0dceb60ee78cab2522f5c3d

Reporting entityFIDELITY NATIONAL INFORMATION SERVICES, INC.

Victim entityWebster Bank, National Association

Incidentdiscovered May 31, 2023

Stated responseImmediately ceased using MOVEit Transfer and disabled it in its system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov